CheckpointQATrust & security
Built to be inspected.
You're evaluating a tool that will hold your audit evidence, so you should scrutinise it. This page tells you how your data is handled, what we can and can't yet claim, and exactly what happens to your evidence if you ever leave — in plain terms, without rounding up.
How your data is held
Per-tenant database isolation
Each organisation's data lives in its own dedicated database, not a shared table with a filter. Isolation is architectural, not just a query condition.
Capability-based access & sensitivity ladder
Permissions are fine-grained capabilities with a graded sensitivity model, so people see and do exactly what their role warrants — no more.
UK data residency
Your quality data is held in the UK region. Exact residency and sub-processor details are set out in the Data Processing Agreement — ask for it during your walkthrough.
Tamper-evident audit trail
An append-only, hash-chained trail with daily digests and a verify step. If a record were changed after the fact, the chain would reveal it.
Certifications & independent assurance — where we honestly stand
We will never claim a certificate we don't hold. Here is the real picture today, and what's planned.
In place
- Security architecture built on ISO 27001 Annex A controls (informed, not certified)
- GDPR tooling & data-subject support
- Self-assessed accessibility VPAT (WCAG 2.2 AA)
Planned
- Cyber Essentials Plus (first certification)
- Independent penetration test
- Independent accessibility audit
- ISO 27001 certification
We do not claim
- Any current ISO 27001 or SOC 2 certificate
- That we "make you" ISO 9001 certified
- Independent test results we don't yet have
If you leave
Your evidence is yours. On the way out, too.
Per-tenant isolation is a genuine strength — and we know it raises the fair question of lock-in. So we answer it directly: full export of your registers and documents in open formats, and an honest written statement of what carries over cleanly and what needs rework. We'd rather earn the renewal than hold your data hostage.
- Registers export to CSV / XLSX
- Documents export with their metadata
- A written, honest portability statement
"You're small — what if you disappear?"
A fair question, and one we plan for openly: no proprietary infrastructure that can't be rebuilt, a documented rebuild-from-cold, and a source-escrow and successor arrangement for continuity. Ask us for the detail — we won't be cagey about it.
Accessibility, held to WCAG 2.2 AA
We publish a self-assessed accessibility conformance report (VPAT) that works its gaps openly rather than claiming a clean sheet — and an independent audit is on the plan. Ask for the current report.
Found a vulnerability? Our disclosure policy is at /.well-known/security.txt.
Want the underlying detail?
On a walkthrough we can share the security architecture summary, the DPA, and the current VPAT — and answer an auditor's questions directly.